The EU Cyber Resilience Act: what Canadian exporters must report since 2026-09-11

If you sell connected hardware or software into the European Union, the EU’s Cyber Resilience Act (CRA) now applies to you, even if your company has no office in Europe. Its first obligations went live on 2026-09-11. As Raymond Chabot Grant Thornton put it for Quebec exporters, cyber security has become a passport for exporting (RCGT).

What the CRA covers

The CRA sets cybersecurity requirements for “hardware and software products with digital elements”, from smart devices to apps and computer programs. Compliant products will carry the CE marking, and national market surveillance authorities will enforce the rules (European Commission).

Pure software-as-a-service is generally treated as a service rather than a product, but remote data processing that a product needs to perform its functions can fall within scope. The Commission’s 2026-07-27 guidance clarifies the treatment of remote data processing solutions and free and open-source software, with practical examples (Commission guidance). Check it against your own product before concluding you are out of scope.

Key dates

• 2024-12-10: the CRA entered into force (Commission).
• 2026-09-11: manufacturers must report actively exploited vulnerabilities and severe incidents.
• 2027-12-11: the main obligations apply, including security-by-design requirements, vulnerability handling, conformity assessment and CE marking.

The reporting clock already running

Since 2026-09-11, manufacturers must report actively exploited vulnerabilities in their products, and severe incidents affecting their security, on a strict timeline (Commission):

• an early warning within 24 hours of becoming aware;
• a notification within 72 hours;
• a final report no later than 14 days after a corrective measure is available (for vulnerabilities), or within a month of the 72-hour notification (for severe incidents).

Reports go through the CRA Single Reporting Platform to the national computer security incident response team and to ENISA, the EU cybersecurity agency.

Penalties

Breaching the CRA’s essential cybersecurity requirements can lead to fines of up to €15 million or 2.5% of worldwide annual turnover, whichever is higher (Regulation (EU) 2024/2847).

What Canadian manufacturers and software vendors should do

1. Confirm scope. List products sold or distributed in the EU and check each against the Commission’s guidance.
2. Stand up vulnerability intake now. You need a way to learn about exploited vulnerabilities, triage them and report within 24 hours. A published vulnerability disclosure policy and a monitored security contact are the minimum.
3. Know your components. A software bill of materials makes it possible to tell quickly whether a newly exploited vulnerability affects you.
4. Plan for 2027. Security by design, secure defaults, update mechanisms and technical documentation take time to build into products.
5. Reuse existing programs. ISO 27001, secure development practices and regular penetration testing support CRA evidence.

For EU privacy developments affecting Canadian businesses, see Canada’s EU adequacy status. KW Consulting and Ubitrak help software and device makers build vulnerability handling and testing programs. Contact us.

Sources

• European Commission: Cyber Resilience Act
• European Commission: CRA reporting obligations
• European Commission: new guidance to support Cyber Resilience Act implementation (2026-07-27)
• EUR-Lex: Regulation (EU) 2024/2847 (Cyber Resilience Act)
• Raymond Chabot Grant Thornton: La cybersécurité, un passeport pour exporter (2026-04-25, French)